diff --git a/changelog.md b/changelog.md
index 3900ffd4a..29fea88eb 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,3 +1,122 @@
+## 1.0.100 - 2026-10-19
+
+- Add --disable-client-telemetry flag to turn off client telemetry uploads from the CLI
+- Add --trust-folder for one-off prompt-mode sessions started with -p or piped stdin
+- Install verified Skills and plugins from GitHub install links via copilot plugin install "ghapp://air/install?..."
+- Open /share without arguments to view a full-screen action menu for sharing the current session
+- Sandbox host-rule traffic now honors HTTPS_PROXY and HTTP_PROXY when no sandbox proxy is configured
+- Voice dictation no longer inserts language markers like <en-US> into transcript text
+- Managed plugins update activation in existing sessions when managed policy changes
+- Sessions no longer stall for minutes when an MCP server hangs while loading tools.
+- Gemini tool calls no longer fail when array parameters define enum values
+- Gemini chats no longer fail after earlier tool results contain no readable content.
+- Sandboxed shell commands now explain credential-proxy certificate trust failures and can offer an approved rerun outside the sandbox.
+- Keep saved /diff review comments when reopening an unchanged diff in the same session, with an explicit discard action.
+- Plugin enable, disable, update, and uninstall actions now route reliably after plugin inventory refreshes.
+- Reasoning-only max-token responses no longer loop indefinitely and now end with a clear error when no progress is made
+- Show a clear warning and keep the active model display in sync when a saved model is automatically replaced on resume.
+- Sandboxed commands on Linux start more reliably without intermittent loopback setup failures
+- Back from MCP resource details stays on the list during live metadata refreshes
+- Native chats can start and finish while optional managed plugin downloads continue in the background.
+- Double Ctrl+C exits immediately even when the CLI UI is busy
+- Catalog search reports proxy authentication requirements for CONNECT proxy challenges
+- HydraFusion keeps a pass expanded while its review runs, passes that were not kept stay expandable until you switch sessions or resume, and passes from an aborted turn say whether they were kept
+- Managed account policy and bypass-mode warnings stay accurate after switching accounts, even when a policy cache miss happens.
+- Avoid false context exhaustion and rollover refusal when tool definitions are deferred
+- Custom agents that declare the documented `search`, `web` or `todo` tool aliases, or name `github-mcp-server/web_search`, now receive the matching tools
+- CLI help and version flags exit reliably after printing their output
+- Enterprise-managed ask permissions in Assisted mode now allow safe actions without unnecessary confirmation prompts.
+- Keep your selected Microsoft Entra account pinned during sign-in and token renewal
+- Up from sessions sidebar header actions wraps to the last visible session
+- Plan, autopilot, and shell mode badges stay visible while startup components load and the agent works. The badge replaces the mode suffix that used to trail the activity text (`Working - plan`), and the startup `Loading:` row now truncates its diagnostics to keep the status row on one line
+- Sandboxed commands can write package and build caches when developer tool access is enabled.
+- Windows CLI Git commands now recover from thread-access-denied startup failures.
+- A skill `allowed-tools` rule keeps commas inside its arguments instead of being split apart. Where a list's structure is ambiguous, its unscoped rules now prompt instead of being granted.
+- MCP resource dashboard stays interactive while inventory adapters refresh
+- Retry image-bearing Responses requests with smaller payload limits when providers reject oversized bodies
+- Complete usage reporting no longer shows partial status or phantom unattributed spend after resume when billing data is complete.
+- Assisted permissions send nested PowerShell and bash -c commands that only expand plain-data environment variables, single-quoted PowerShell, and PowerShell variable and alias statements to the permission judge instead of requiring unnecessary manual approval
+- Path-specific instruction files in the repository root .github/instructions are now applied automatically when the agent reads or edits a matching file
+- Start git, shell commands, and MCP servers on Windows when process snapshot thread enumeration fails
+- Use the unified Sessions browser by default for /sessions, /session, and /resume.
+- Session browsing now caps account discovery at 500 records and respects Retry-After hints for automatic refresh timing.
+- Prompt to update the sandbox proxy certificate authority when masked hosts change
+- Show a clear notice when administrator-managed settings override your selected model
+- Enable semantic code search by default for online sessions.
+- Improve /login for Microsoft Entra by letting you choose a cached account or explicitly sign in with a different account
+- Sandboxed git on github.com can use your configured GITHUB_TOKEN from credentials.envVars
+- /sandbox can keep sandboxing enabled for the current session without enabling it globally
+- Trusted repository plugins install and update automatically before chat runs.
+- Rename the built-in browser plugin to browser-use and keep existing browser plugin preferences working after upgrade
+- Sandbox allows local network access by default so commands can reach localhost and private-network services.
+
+## 1.0.98 - 2026-10-14
+
+- Add support for Gemini 4 Argon
+- Command hooks complete reliably even when child-exit signals are lost under Node
+- MCP status and /mcp commands stay synced to the active session after split-view session switches
+- Resuming a session now respects abandoned pending-permission work and continues only active permission requests.
+- Keep ordinary characters typed while the input box is still coming up at startup, instead of dropping them
+- Expand /ask answers with Ctrl+E, copy the entire answer with Ctrl+Y, and reopen the last usable completed answer in the session with /ask or /btw.
+
+## 1.0.97 - 2026-10-13
+
+- Add agent-scoped declarative hooks for custom agents
+- Remote plugin marketplace and plugin fetches retry once with your signed-in GitHub token after HTTPS auth fails.
+- Streamed responses behind TLS-intercepting proxies complete when close_notify is omitted
+- Fix parsing of GitHub SCP remotes with absolute paths so repository owner and name resolve correctly
+- Discover all custom agents even when repositories define more than 100 or nest agent files deeply.
+- Autopilot denies a preToolUse hook's "ask" decision instead of stopping on a permission dialog nobody is watching
+- Keep Windows taskbar agent icons grouped across CLI updates by using a stable icon path
+- Keep saved settings such as dismissed prompts, trusted folders and sign-ins when one entry in config.json is invalid, instead of resetting them on every launch
+- In /config, managed permission rules are read-only and hidden unless set by your organization.
+- Show billed AI Credits in /usage for token-billed sessions, including after resume
+- File reads using a view_range that is not exactly two elements, such as a lone start line, now show their line range and line count in the timeline, and session exports no longer contain the literal text undefined
+- Dragging to select text in the transcript no longer occasionally highlights and copies the row below the pointer.
+- Power BI and Bluebird MCP servers accept their published resource scopes during sign-in
+- Redact secrets safely in --output-format json output while preserving valid variable references
+- Resuming suspended sessions now reports interrupted tool calls and avoids replaying canceled writes.
+- Synchronous /task JSON output now includes failed child error and lifecycle events before completion.
+- Explicit GitHub MCP tool and toolset selections use the correct endpoint, so requested write tools stay available.
+- Cached MCP tool calls recheck their definition when a concurrent tool-list refresh changes the catalog.
+- Skills and custom agents from --plugin-dir plugins now reach autocomplete and invocation instead of going missing.
+- Fixed resumed sessions rebuilding plugin hooks from the wrong plugin list, so hooks from repository-local marketplace plugins now keep running after `--resume`, and hooks from plugins your configuration disabled no longer come back
+- Keep /user switch new-session choices visible after account checks in short terminals
+- Unavailable permission recovery attempts are now tracked per request, so unrelated calls no longer consume each other's retry budget.
+- Background-shell wait status no longer animates when no foreground work is running
+- Emergency memory relief in long sessions can now bypass its cooldown before V8 aborts, so a session that would have been killed by a JavaScript heap out of memory crash may survive with compacted history instead
+- Inline images render by default on supported terminals without enabling experimental mode. Use `/settings inlineImages false` to turn them off
+
+## 1.0.96 - 2026-10-12
+
+- Interactive sandbox settings suggest possible environment secrets and let you add masking hosts before saving.
+- Make model IDs in /model and /config model case-insensitive and save canonical IDs
+- Keep /allow-all available during startup while enterprise policy is still resolving
+- /add-dir grants sandbox access to added directories for the current session
+- /user list shows the authentication source for each signed-in account
+- Show retry progress messages before recovered responses after transient model failures
+- Model completions no longer show an authentication warning when an account-owned catalog is unavailable while signed out
+- Interactive sessions in git repositories reach the input prompt sooner
+- Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.
+
+## 1.0.95 - 2026-10-09
+
+- Use native Microsoft Entra broker authentication on macOS when available, with browser fallback.
+- copilot config supports sandbox credential injectHosts keys, with key completion in Bash, Zsh, and Fish.
+- --context now applies to new and resumed ACP sessions instead of silently using the default or previously saved context tier
+- Managed plugin setup retries hourly or after policy changes instead of on every message failure
+
+## 1.0.94 - 2026-10-08
+
+- Add Claude Haiku 5.5 to model selection and --model completions
+- copilot mcp add recovers cleanly after interrupted MCP config initialization
+- MCP enable/disable now works before server discovery without starting MCP servers
+- Assisted permissions send visible shell code to the permission judge instead of requiring unnecessary manual approval
+- Show a policy warning when startup bypass-permission flags are suppressed by managed settings
+- Clicking a Sessions sidebar row now reliably switches sessions during split-view reconciliation
+- Show update guidance when managed settings request a newer CLI version without blocking normal prompts
+- Managed policy can disable Assisted Permissions and keep sessions in Manual Approval mode.
+
 ## 1.0.93 - 2026-10-07
 
 - Add enterprise permissions.limitTo to enforce managed domain boundaries for network requests